Greetings all,

I am a long time lurker of these forums and have found the topics and resources on this site to be most useful and valuable. So thank you very much.

However I need some further help and would appreciate any opinion you could offer.

As part of a current job I am working on, I have encountered a video that may be of evidential value. The video itself is present within a .dat file, and the file is located in \temporary internet files\Content.IE5\XXXXXXXX\xx[x].dat

How might I be able to determine how this video came to be where it is? I have used HstEx/NetAnalysis and Encase6 to try and analyse it. Nothing within the internet history gives any clues as to how it got there. All I have is the carved movie itself (mpg) and a timestamp on the actual .dat file.

Any pointers would be great, thanks  

Hi bitmadmax,

Can you advise what the actual filename is?

Have you tried doing a keyword search in the index.dat files (or anywhere else) for that filename?

Regards,
Jad  

- bitmadmax

How might I be able to determine how this video came to be where it is? I have used HstEx/NetAnalysis and Encase6 to try and analyse it. Nothing within the internet history gives any clues as to how it got there. All I have is the carved movie itself (mpg) and a timestamp on the actual .dat file.

Random thoughts.

Streams attached?
Like Zone.Identifier?
www.nirsoft.net/utils/...reams.html

If the filename is - as I presume - something like:
mynicemovie[n].dat
kb.digital-detective.c...orer+Cache
and n is not 1, then another copy has been downloaded/accessed through Explorer.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

- bitmadmax

As part of a current job I am working on, I have encountered a video that may be of evidential value. The video itself is present within a .dat file, and the file is located in \temporary internet files\Content.IE5\XXXXXXXX\xx[x].dat

As already mentioned, the complete name of the file would be very helpful.

- bitmadmax

How might I be able to determine how this video came to be where it is? I have used HstEx/NetAnalysis and Encase6 to try and analyse it. Nothing within the internet history gives any clues as to how it got there.

Timeline analysis might be very useful in this case.

- bitmadmax

All I have is the carved movie itself (mpg) and a timestamp on the actual .dat file.

Carved? When you say that this video was "located in" the file, what do you mean? Was the video embedded in the file with other data, or did it appear that the .mpg file was simply renamed to .dat?

Is there anything in the video that might reveal something about from where the movie originated?  

Hello Bitmadmax - is that .dat file perhaps deleted?
_________________
Blog: secureartisan.wordpress.com